Security Resilience

CWE · MITRE source

CWE-611Improper Restriction of XML External Entity Reference

Abstraction: Base · CVEs in our corpus: 1,351

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

Last updated: 15 October 2026 20:36 UTC

OWASP Top 10 for Web (2025)

This weakness contributes to A02:2025 Security Misconfiguration.

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent
Stop it (NIST 800-53 / CSF Protect)
  • CA-8 Penetration Testing
  • SI-4 System Monitoring
  • PR.PS-01
  • PR.PS-06
Detect
Catch it (CSF Detect / Respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V1.5.1
  • V15.3.2

NIST 800-53 r5 controls PROPOSED for this weakness (2)AI-assisted

These are model PROPOSALS, not graded mappings. They come from controls_to_cwe_proposals, which carries no grade field at all; across the CWE pages 1,540 of 1,722 such associations (89%) have never been graded by anything. The heading said “address” until 2026-09-29, which asserted a relationship the data does not carry. Graded cross-walks are on the framework map, not here.

Control Title Family Why it addresses this CWE
CA-8Penetration TestingCAPenetration testing includes XML external entity payloads, detecting XXE vulnerabilities and enabling their mitigation.
SI-4System MonitoringSIIdentifies XML external entity processing via monitoring of unusual file/network access or resource usage.

Top CVEs of this weakness type, ranked by Risk Priority

CVE Risk CVSS EPSS Published
CVE-2017-12629 9.99.80.91902017-10-14
CVE-2019-9670 KEV 9.99.80.99992019-05-29
CVE-2022-28219 9.99.80.97192022-04-05
CVE-2024-34102 KEV 9.99.80.99992024-06-13
CVE-2021-37425 9.39.10.66282021-08-10
CVE-2025-2775 KEV 9.39.30.42612025-05-07
CVE-2025-2776 KEV 9.39.30.64732025-05-07
CVE-2025-2777 9.29.30.72662025-05-07
CVE-2019-7442 9.19.80.40012019-05-08
CVE-2012-3363 8.99.10.49312013-02-13
CVE-2018-13415 8.99.80.31812018-08-13
CVE-2025-30220 8.99.90.42292025-06-10
CVE-2025-58360 KEV 8.98.20.60522025-11-25
CVE-2025-66516 8.98.40.88982025-12-04
CVE-2018-15531 8.89.80.27872018-09-26
CVE-2023-44412 8.88.20.82312024-05-03
CVE-2025-54254 8.88.60.77462025-08-05
CVE-2016-4264 8.78.60.69042016-09-01
CVE-2018-13417 8.69.80.20692018-08-13
CVE-2018-8420 8.68.80.48902018-09-13
CVE-2024-22024 8.68.30.94722024-02-13
CVE-2018-13416 8.59.80.19942018-08-03
CVE-2019-13608 KEV 8.57.50.30042019-08-29
CVE-2018-1285 8.59.80.17822020-05-11
CVE-2023-45727 KEV 8.57.50.03542023-10-18